The safe and secure implementation of increasingly complex features is a major challenge in the development of autonomous and distributed embedded systems. Automated design-time procedures that guarantee the fulfillment of critical system properties are a promising approach to tackle this challenge. In the European project XANDAR, which took place from 2021 to 2023, eight partners developed an X-by-Construction (XbC) design framework to support developers in the creation of embedded software systems with certain safety, security, and real-time properties. The design framework combines a model-based toolchain with a hypervisor-based runtime architecture. It targets modern high-performance hardware, facilitates the integration of machine learning applications, and employs a library of trusted safety and security patterns to reduce the implementation and verification effort. This paper describes the concepts developed during the project, the prototypical implementation of the design framework, and its application in both an automotive and an avionics use case.

The ongoing trend of centralization of functionality and the resulting integration of previously distributed software components in automotive systems leads to mixed-criticality architectures on those resulting central execution platforms. Multiprocessor system-on-chip architectures provide a powerful platform for centralized execution. A major challenge arises in the safe and secure scheduling of software components on those platforms. Real time tasks can be delayed by interfer-ences occurring by simultaneous access onto shared resources. Meeting deadlines and eliminating contention is often guaranteed by using hypervisors or real time operating systems, which provide a runtime environment to enable tasks to meet their respective deadline in mixed-criticality systems. These runtime environments frequently employ TDMA-based scheduling for a predictable and certifiable execution. In this work, we introduce an algorithm creating scheduling tables for TDMA schedulers that support isolation mechanisms in multicore systems. Using a constructive approach, the resulting scheduling tables support mechanisms for parallel access to shared resources and windows for exclusive execution. Our approach is validated by reconstructing previously generated and valid synthetic scheduling tables. We achieve a high success rate in all cases for a processor utilization of up to 80 % with an algorithm runtime of 10 seconds.

The deterministic integration of concurrent functions on shared multicore platforms is a challenging yet important task. Especially in safety-critical environments, hypervisors can be used to achieve time and space partitioning, but their sole application is often insufficient to guarantee deterministic timing and data flow behavior. Considering the growing complexity of modern embedded systems, for example in terms of functionality and mixed-criticality requirements, model-based approaches are a promising starting point to tackle this issue. In this work, we bridge the gap between a model-based behavior specification methodology based on the Logical Execution Time (LET) concept and target platforms running a commercially available bare-metal hypervisor. Therefore, this paper describes a runtime environment that implements LET semantics at the level of hypervisor partitions and a tool-supported design methodology that deploys software to this runtime environment. From a behavior specification provided as a system model with annotated C code, the presented deployment tool generates binary images with guaranteed timing and data-flow behavior for the XtratuM hypervisor. The approach is finally validated by applying it to a Flight Assistance System (FAS) from the avionics domain.

Realizing desired properties “by construction” is a highly appealing goal in the design of safety-critical embedded systems. As verification and validation tasks in this domain are often both challenging and time-consuming, the by-construction paradigm is a promising solution to increase design productivity and reduce design errors. In the XANDAR project, partners from industry and academia develop a toolchain that will advance current development processes by employing a modelbased X-by-Construction (XbC) approach. XANDAR defines a development process, metamodel extensions, a library of safety and security patterns, and investigates many further techniques for design automation, verification, and validation. The developed toolchain will use a hypervisor-based platform, targeting future centralized, AI-capable high-performance embedded processing systems. It is co-developed and validated in both an avionics use case for situation perception and pilot assistance as well as an automotive use case for autonomous driving.

Safety-critical real-time systems must be carefully designed to guarantee both functional and temporal correctness. State-of-the-art approaches to achieve this are often based on formal notations capturing both the desired functionality and relevant timing properties. This work is concerned with the design of embedded software systems for emerging fields such as the Urban Air Mobility (UAM) sector. In this context, it deals with scenarios that benefit from a less formal programming model, but for which guarantees on functional and timing behavior must still be provided. We propose a concept to specify and simulate the behavior of embedded real-time software in a deterministic manner. It combines the Logical Execution Time (LET) paradigm with a flexible, code-based approach for behavior specification and performs discrete-event (DE) simulations to determine how exactly the designed system responds to given stimuli. We describe this concept, present a reference implementation using Ptolemy II as simulation backend, and discuss its application to a pilot assistance system from the UAM sector.

In recent years, multi-core processors are becoming more and more common in embedded systems, offering higher performance than single-core processors and thereby enabling both computationally intensive embedded applications as well as the space-, weight-, and energy-efficient integration of software components. However, real-time applications, for which meeting certain deadlines must be guaranteed, do not profit as much from this transition. This is mainly due to interference between the processing cores of commercial-off-the-shelf multi-core processors at shared resources, hampering the predictability of task execution times. An effective approach to avoid this is running the critical tasks exclusively on one core while pausing execution on all other cores. This, however, reduces the overall system efficiency since parallel execution potential remains unused. In this work we present a novel approach to managing shared and exclusive execution in such systems. By on-line observation of the critical task progress via the on-chip trace infrastructure, we reduce the time of exclusive execution when it is safely possible and thereby increase the overall system efficiency. Using trace information allows for early detection of parallelization potential and does not require modifications to the critical application, which helps avoiding re-certification of the critical application. We present an implementation on a heterogeneous multi-processor system-on-chip using a state-of-the-art hypervisor for critical systems and evaluate its performance. Our results indicate that a performance gain of 37 % to 41 % over approaches focused on exclusive execution can be reached in low-interference situations.

The integration of connected and autonomous technologies in safety-critical and cyber-physical systems offers great potential in the vital application domains of transportation, manufacturing and aerospace. These technological advancements are necessary to meet the increasing demand for intelligent services, as they open doors to new business models by analysing and sharing the generated data. However, where this sharing of mix-critical data and broader connectivity brings opportunities, it simultaneously presents serious cybersecurity and safety risks due to the cyber-physical nature of these systems. Hence, delivering these intelligent services securely, safely, and reliably to its consumers is a complex engineering and design problem. One of the ways to approach this engineering problem is to consider both system functional and non-functional properties (safety, security, reliability) and systematically integrate them across system design and operational life cycle. The XANDAR project investigates this approach and aims to develop holistic software design methods and architectures for safety-critical and cyber-physical systems that guarantee functional and non-functional properties “byconstruction”. This paper focuses on the non-functional aspects of the project and discusses the preliminary work. by presenting the core cybersecurity principles and uses them as a baseline to propose a holistic cybersecurity engineering process. The tasks of the proposed cybersecurity engineering process are also map onto relevant clauses of ISO 21434. In future, proposed work will be integrated into the XANDAR software toolchain and validated for an avionics situation perception pilot assistance and automotive autonomous driving use cases.

The next generation of networked embedded systems (ES) necessitates rapid prototyping and high performance while maintaining key qualities like trustworthiness and safety. However, development of safety-critical ES suffers from complex software (SW) toolchains and engineering processes. Moreover, the current trend in autonomous systems, which relies on Machine Learning (ML) and AI applications when combined with fail-operational requirements renders the Verification and Validation (V&V) of these new systems a challenging endeavor. Prime examples are Advanced Driver-Assistance Systems (ADAS) that are prone to various safety/security vulnerabilities. The XANDAR project aims at developing a mature SW toolchain (from requirements analysis to the actual code integration on target including V&V) fulfilling the needs of industry for rapid prototyping of interoperable and autonomous ES. Starting from a model-based system architecture, XANDAR will leverage automatic model synthesis and software parallelization techniques to achieve specific non-functional requirements setting the foundation for a novel (real-time, safety-, and security)-by-Construction paradigm.